A message from our CEO about the future of Stack Overflow and Stack Exchange. Read now.

Questions tagged [encoding]

Encoding is a set of predefined rules to reversibly transform a piece of information in a certain representation into a completely different representation. The other way round is called decoding.

Filter by
Sorted by
Tagged with
0
votes
0answers
4 views

Help to understand what's inside base64 string [migrated]

While performing a file upload, a template parameter is sent together with file. Service acts differently when different parameters are passed. I need help to figure out what this parameter contains. ...
0
votes
1answer
48 views

Single and double Encoding of parameters to bypass security filters

I was practising some labs to get better at XSS and SSRF. I found that sometimes I just encode characters once and the security filter is bypassed and occasionally I have to encode it two times. How ...
0
votes
0answers
15 views

finding url encoding algorithm [duplicate]

I have a URL: https://dl.macneed.ir/17.azar.98/JoyVidCon30013_macneed.ir.zip?md5=zERex79LZe0SL2GqLkXGkA&expires=1575906351 I want to know how can I generate a trusted URL like it. md5 = ...
37
votes
2answers
6k views

What does this “ICAgICAg…” mean in public key certificates and messages?

I noticed that the string ICAgICAgICAgICAgICAg, in various repeating lengths, appears fairly often in public key certificates and ciphertexts. What does this mean? Is it some kind of padding? Is it ...
1
vote
1answer
81 views

XSS in HTML Context without < and >

I have a webpage that blindly removes < and > as hardcoded rule. I know XSS doesn't always need < and > since it is not needed in HTML attribute and javascript contexts. But is it ...
1
vote
0answers
20 views

determine type of encoding/encryption [duplicate]

Is there a way to find out what type of encryption is being used on this data? I was playing around with a game data and i cant get around it . This Is the data im trying to decrypt, any help? Code: ...
0
votes
0answers
338 views

How to solve: Problem with converting pkcs12 file into a pem

I am trying to convert a client certificate from a pkcs12 type to a pem file using openssl, but this error is showed on my terminal. Does anyone have any idea why this is happening? I haven't edited ...
0
votes
0answers
83 views

How do you generate a RSA private key that is BER encoded with OpenSSL?

According to the Linux Kernel's Asymmetric Cipher API found at the following URL: https://www.kernel.org/doc/html/latest/crypto/api-akcipher.html#asymmetric-cipher-api, you must pass a BER encoded ...
0
votes
1answer
93 views

How to fix XSS in rails

I am able to inject javascript:alert `1` or javascript:alert(1) into the href field of the rails app and it is getting executed as JavaScript. Html encoding is already implemented but it doesnt encode ...
1
vote
2answers
256 views

Weird character sequence in email subject

I've noticed that the subject in one of the spam emails looks like this in source: Subject: Offe=?UTF-8?Q?=EF=BB=BF?=r fr=?UTF-8?Q?=EF=BB=BF?=om C=?UTF-8?Q?=EF=BB=BF?=redi=?UTF-8?Q?=EF=BB=BF?=t On=?...
0
votes
1answer
66 views

Server error when entering a percent symbol in search? [closed]

Fuzzing a website and came across an odd behavior. The site has a search bar, it sends queries via a GET request with the standard ?q= parameter. When I try the standard XSS payloads such as <...
0
votes
0answers
63 views

How to determine the encoding used when you have the data not the source code [duplicate]

The source code converts the data as below: 00000 - 62F0CBA67EA6A2C03D399A1B06D82787CB46480370FDA0C1CF5016E59A61F0A6 000000 - F657FC2120036C2EF29AF87E4194539B1728AB2F204676E413C6FFD5970453B9 ...
0
votes
0answers
13 views

Is there any identification for common encoding/encryption? [duplicate]

While pentesting (web application) I come across lots of tokens which might be simply encoded and not random, but I don't know any way to identity if they are encoded or random, how to find is there ...
5
votes
1answer
149 views

Do ciphers and encoding schemes make passwords more secure?

I recently came across a tech professional advising a user to take some plaintext of their choice, run it through one of these ciphers, convert it to Base64, and then use the result as their master ...
-2
votes
1answer
92 views

how to decode this request [closed]

I need help for this. I got a request but I don't know what can I do: GET http://localhost/xor.php?plaintext=cipher=%00%00%1D%10%1A,%06%05%16%16%0D%12%0B%3A9%5DRT%06YVD HTTP/1.1 Full request : https:...
2
votes
1answer
235 views

Problem with Reverse Engineering GVM light, possibly encoding issue

So I bought this GVM-560AS LED photography light on Amazon. It is a really good light for the job; but to control it remotely you have to download a really dodgy APK from the GVM website, a package ...
0
votes
3answers
168 views

What string encoding options are there besides xor? [closed]

When attempting to obfuscate strings in a modern program, xor is probably the most common option. By this I mean running each char of a string through a function which xors the char with some given ...
1
vote
0answers
62 views

rar and zip password encoding scheme [closed]

What encoding scheme is used in last versions of ZIP archives(6.3.2+) and RAR archives(3.90+), including RAR5? UTF-8/16, ASCII or something else?
-1
votes
1answer
194 views

What's the purpose of Base64 if knowing its Base64 makes it easy to decode

The title I think gets the point across. Lets focus solely on these hypothetical situations: Basic Auth headers when making API calls with user:pass Storing passwords in an SQL database What makes ...
1
vote
0answers
46 views

What exactly is URL-safe Base 64 encoding? [closed]

And how is it different form the normal Base 64 encoding?
1
vote
1answer
156 views

Encoding ASCII character as three-byte UTF-8. How does it work?

I'm reading a report on HackerOne https://hackerone.com/reports/52042. An input filter was bypassed by sending %E5%98%8A that was then parsed as 0x0A character (new line). The %E5%98%8A sequence ...
1
vote
0answers
78 views

Help needed in identifying a string [closed]

I need help in identifying the following string in order to decode it to a piece of meaningful information. h_t_s_/_g_s_._k_l_b_c_m_4_9_a_k_6_f_8_4_8_e_e_r_9_3_9_f_
5
votes
3answers
2k views

Encoding output in JSON HTTP API

I'm the author of a JSON REST API. This REST API is consumed by various clients, such as HTML/JS-clients, .NET clients (console applications) and Ruby clients. The output of the API is in JSON format, ...
2
votes
3answers
320 views

Is it risky to URL-encode characters in an already URL-encoded string?

I'm maintaining a legacy web application which is composed of the application itself, accessible to the public, and the REST services which can be accessed only by the application through the LAN. At ...
0
votes
2answers
246 views

is encoding the same as encryption for malware obfuscation?

I have been learning about hiding and executing msfvenom created shellcode and came to a technique where we xor the shellcode and when executing we reverse it.Would it be the same if i just encrypt it ...
0
votes
3answers
622 views

Why doesn't XSS execute when bypassing HTML encoding?

I am trying to execute an XSS payload on a search field that takes my input like this: <input name="q" id="gsasearch" type="text" value="My Input"></input> Observations: <, > and "...
1
vote
0answers
198 views

Help figuring out this hash function [closed]

I have a tough nut to crack. I'm working on hashing passwords for our network switches (because the alternative is plain-text passwords...). For people who would care about this; it's a huawei switch. ...
0
votes
1answer
243 views

Odd characters — including a backslash — in magstripe track 1 name field?

I've been in the Point of Sale industry for decades. Parsing card magnetic stripe track 1 data has never been difficult, but lately we've started to see some odd data in the name field of cards that ...
0
votes
1answer
38 views

Problem identifying this encoding schematic into plain text [duplicate]

Im really new to all of this i'd like some insight. the encoding scheme looks like this e0b7 e51f a24f 2ee8 f950 ecc4 d46b 6b3b 11bd 1930 ccb0 3c9f ecf5 368d f570 c72d a37e 47a6 bf03 2cf4 947c e913 ...
2
votes
2answers
9k views

XSS with URL encoding

If a website URL gets encoded then is the website still vulnerable to XSS or no? For example, if I try <script>alert(1)</script> and the site URL encodes my payload to %3Cscript%3Ealert(1)...
3
votes
2answers
632 views

Is reflected XSS impossible, when HTML meta-characters, e.g., < and >, are encoded, and the result output in HTML context?

Is reflected XSS impossible, when HTML meta-characters, e.g., < and >, are encoded, and the result output in HTML context? I have a website that displays the URL path directly in HTML context, i.e....
3
votes
1answer
229 views

Exploit user input being directly inserted into PDF

I'm testing a web application where user input is directly inserted into a PDF file which can then be downloaded. The user input is accepted as is, without encoding or any other modification. This ...
0
votes
1answer
278 views

Is a substring of base64 encoded random_bytes less secure then just using random_bytes

$bytes = random_bytes(15); $encoded = base64_encode($bytes); $output = substr($encoded, 0, 15); Does this code affect the complexity of the output vs just using $output = random_bytes(15); I think ...
1
vote
1answer
563 views

ASN.1 encoding of X25519 private key

I'm using mbed TLS for ECDH key agreement using Curve25519. The private and public keys are stored and transmitted as Hex strings as easily generated with mbed TLS. Those strings are big-endian. This ...
0
votes
1answer
55 views

SQL Query Sanatization

It seems to me SQL injection could be avoided by just converting everything to a simple encoding like base64 that doesn't have any harmful symbols. In the classic query "SELECT * FROM users WHERE ...
1
vote
0answers
85 views

Server improperly handling unicode characters?

So I'm pen-testing a web application. Upon submitting certain data it sends it in a POST request which contains the data in a JSON object. So while fuzzing it I was testing for improper encoding ...
4
votes
1answer
459 views

Hydra - Attacking when login page encodes the username and password

I needed to test how Hydra works, so I tried to attack my own wifi router. I set the user name as "user" and created a txt file containing 100 passwords including the "real" password. I am unable to ...
2
votes
0answers
478 views

Security risks with pdf files in object tag at client/server side

This is my situation: a user uploads a pdf file to my server. The data travels encoded in base64 (like a regular input in a form). The base64 is saved in one particular file on my server. Now, another ...
23
votes
1answer
6k views

When and why does bypassing XSS sanitizers with double encoding work?

I have read in different sites about different ways to bypass XSS sanitizers, like double encoding special characters such as /<>:"', or employing different encoding schemes. However most of ...
0
votes
2answers
862 views

Is it safe to get html encoded data from database to prevent stored XSS attack?

for security purpose now i'm fetching all data from database with htmlEncoded format. it is correct? please help..
1
vote
0answers
116 views

Exploiting XSS when attack vector is passed in Javascript context after being HTML encoded?

My attack vector is being passed in three contexts. HTML element: <p>injection</p> HTML attribute value: <input value="injection"> Javascript: <script> var a = "...
0
votes
0answers
2k views

Should Content-Encoding deflate be disabled [duplicate]

After scaning web page with Nikto I have results that is "The Content-Encoding header is set to "deflate" this may mean that the server is vulnerable to the BREACH attack." How to verify if that ...
5
votes
1answer
1k views

Why context sensitive encoding to prevent XSS?

OWASP recommends that context-sensitive encoding needs to be done. Please help me in getting a couple of strong "code examples" on why context sensitive based encoding needs to be done and why HTML ...
8
votes
3answers
4k views

How is character encodings used to bypass XSS sanitizers?

I read in different blogs that PHP htmlspecialchars() function has certain problems when one does not give the expected charset as an optional parameter. Can someone explain some basic stuff about ...
2
votes
1answer
95 views

Decoding requests from potentially malicious Android app

I have recently been doing some security evaluation work on our Android applications, by proxying all the communication through Burp Suite. I noticed one of our devices was sending requests to a ...
2
votes
1answer
153 views

Does the ECDSA signature value (of an OCSP response) need to be DER encoded

In OCSP responses by a certain eIDAS PKI I every once in a while get signature values which, when unpacked from their BIT STRING, contain an ECDSA signature whose INTEGER constituents have an ...
1
vote
1answer
387 views

Is it possible to “encode” a bash sentence?

I was recently solving a CTF challenge that I found quite strange, first of all I have been given a chain of characters that no matter how hard I try to find an answer I can not find it, I am going to ...
0
votes
2answers
245 views

Would using a QWERTY keyboard with DVORAK output cause keylogger to log DVORAK?

I have QWERT keyboard, but I have set the keyboard settings in Windows to DVORAK. So if I type "test" it comes out as "y.oy". Would the key logger log "test" or "y.oy" in its records?
2
votes
1answer
911 views

AngularJS Sanitize function vs. server-side output encoding

I mainly audit web applications and provide the companies with security countermeasures and recommendations. Currently, I have an issue with giving a correct recommendation when it comes to AngularJS ...
4
votes
1answer
5k views

Bypassing browsers URL encoding to do reflected XSS from query parameter?

I tried to get reflected XSS in vulnerable website with a request to the following URL: https://vulnerable.website/dir/dir?param1=test"><svg/onload=alert(1)> The browser URL encode the ...